There are three primary mobility protocols for data networks: Mobile IP, Cellular Digital Packet Data (CDPD), and Inter-Access Point Protocol (IAPP). Mobile IP was proposed to support mobile computers on the Internet without considering link-layer handoff details, CDPD has been deployed to support IP-based mobile computers connected to cellular networks, and IAPP is used to support WLAN stations roaming between access points in a Distribution System. Mobile IP and CDPD are designed to provide mobility for large-area data networks. Sometimes they are referred as “macro mobility solutions.” Although IAPP can be operated at the IP layer over the Internet, the common practice is to operate IAPP for mobility support within a subnet, because most routers do not exchange multicast IP packets between subnets.
In Mobile IP, a “home agent” is deployed on the Internet to track the location of mobile computers (hereinafter referred to as “mobile hosts” or “WLAN hosts”) and to route IP packets to the mobile hosts irrespective of their physical locations. A mobile host owns a fixed IP address that belongs to the subnet (i.e., a group of continuous IP addresses with some boundary conditions) of the home agent. Any application programs running on the mobile host use this fixed IP address as the source IP address during network communications. Whenever the mobile host attaches to a subnet, a care-of IP address belonging to the subnet is reported to the home agent, so that the home agent can route inbound IP packets to the mobile host's current location using an IP tunnel. If a foreign agent is deployed on the subnet, the foreign agent's IP address is the mobile's care-of IP address. If there is no foreign agent, the mobile host must have a built-in foreign agent, and it needs to apply an IP address from the subnet for this built-in foreign agent.
All IP packets destined for the mobile host are intercepted by the home agent when they arrive at the home agent's subnet. The home agent encapsulates these packets into new IP packets with the home agent's IP address as source IP address and the care-of IP address as destination IP address. When they arrive at the foreign agent, the encapsulated packets are decapsulated, and the inner IP packets are delivered to the TCP/IP stack of the operating system of the mobile host. IP packets that are communicated from the mobile host to a destination host are encapsulated into new IP packets by the foreign agent. The outer source IP address is the care-of IP address, and the outer destination IP address is the home agent's IP address. CDPD operates similar to Mobile IP, with the foreign agent function built into cellular networks. IAPP is primarily designed as an intra-subnet mobility protocol. IAPP signaling provides for two types of messages: announcement messages and forwarding messages. Whenever a WLAN station associates with an access point, the WLAN station or the access point must multicast the arrival event to other access points belonging to the same Distribution System. This multicast message serves two purposes. First, it educates all link-layer routing instruments in the subnet, such as an Ethernet switch, and causes them to update their internal routing table for routing efficiency. Second, it enforces single association at any given time, in accordance with the IEEE 802.11 standard. The announcement message informs the access point that was previously associated with the WLAN station to forward the frames to the access point that is currently associated with the WLAN station. The multicast mechanism confines the IAPP within a subnet because most of routers do not support multicast crossing the subnet boundaries. In addition, IAPP suffers scalability problems as the number of WLAN stations becomes very large.
WLANs have become increasingly popular since the release of the IEEE 802.11b standard. An 802.11b WLAN access point can support an aggregated transmission rate of up to 11 Mbps and cover a distance of up to 100-300 feet. Since WLAN was designed as wireless extension of the Ethernet for indoor use, it has adopted a simple protocol known as WEP for authentication and encryption. According to WEP, every WLAN station and every access point in a Service Set share a common, static key, called a WEP key. It has either 40 bits (standard) or 128 bits (non-standard). The authentication process is either an open authentication (based on which some advanced authentication method, such as an 802.1x/EAP method, can be built) or a challenge and response authentication based on the WEP key. The encryption algorithm is RC4 with the key sequence generated by the WEP key and a random vector. However, the security flaws of WEP have been highly publicized, which are mainly due to the implementation flaw of the key scheduling algorithm in the RC4 algorithm and the use of a static WEP key shared by everybody.
To address the security flaws associated with WEP, the IEEE 802.1x standard has been introduced and the IEEE 802.11i standard is currently under development. Using the IEEE 802.1x standard along with various EAP (Extensible Authentication Protocol) protocols, WLAN authentication can be managed from a centralized server such as a RADIUS server, using session-specific keys for encryption purposes. Security flaws in the RC4 algorithm implemented in WEP can be fixed to a certain extent if the session-specific key can be changed frequently. According to the IEEE 802.11i standard draft, the AES algorithm will become the ultimate encryption algorithm to protect the over-the-air traffic.
Networking configuration can be a troublesome task for ordinary computer users, especially for those who desire broadband Internet access in public places such as convention centers and hotels. Configuring a computer to communicate with a WLAN is even more complicated. In addition to ordinary configuration jobs such as setting up DHCP , WLAN configuration includes specifying an SSID (Service Set Identifier) and enabling/disabling WEP keys. If IEEE 802.lx is adopted, the configuration task further involves the provisioning of computer accounts at some centralized authentication server, which is extremely inconvenient for users who want to use the WLAN access service anywhere.
In order to address these problems, “zero-configuration” techniques have been developed. Zero-configuration mobility networking (ZCMN) enables Internet Protocol (IP) mobility networking for a mobile host, without the need for the host to be configured with built-in mobility support functions, which typically requires the installation of specialized mobility software and/or hardware. With ZCMN, mobile hosts have fixed IP addresses and are unaware of their mobility. The network tracks the mobile hosts through the fixed IP addresses and routes IP packets to these fixed addresses regardless of a host's physical location. Zero-configuration is accomplished by configuring all WLAN hosts into the most popular mode. In other words, the mobile host uses DHCP to get IP addresses and other IP networking parameters from the network. The SSID is a “default”. The WEP key is disabled and access points admit any WLAN hosts. Authentication is implemented through a Web-based expedient and the access control is implemented at the network layer. Thus, a mobile host obtains an IP address and receives very limited IP routing service from the WLAN such that it can only contact a Web server to obtain a Web page for user authentication purposes. After the user is successfully authenticated to the Web server, limitations on the mobile host's IP address are eliminated, and the mobile host is free to obtain regular Internet access. This method has been adopted by a number of WLAN service providers such as Boingo and GRIC.
The foregoing ZCMN methods pose security concerns for both users WLAN operators. Since the WEP key is disabled and IEEE 802.1x has not been widely adopted, the WLAN is open at the link layer and air traffic is not encrypted. In addition, because after the user is authenticated to the Web server, access control is based solely on the MAC address and IP address of the mobile host, it is relatively easy to steal WLAN service.
ZCMN provides many advantages over common mobility protocols such as Mobile IP, which requires modifications to the TCP/IP stack of the operating system to enable the mobile host to communicate with home and/or foreign agents on the network. Because of the proprietary nature of some operating systems such as Windows®, Mobile IP is impractical. The potential market for large WLAN networks is very promising, and the network side is ready to support mobility. However, there is currently no widely accepted mobility solution on the client side. As the popularity of portable wireless computers and consumer electronic devices capable of supporting networking functions increases, it is desirable to provide a technique that eliminates the need for client-side mobility functions so as to avoid complications for the average user who may not be computer savvy.
ZCMN requires appropriate security solutions for use in the WLAN environment. Current ZCNM for WLANs include IAPP, PacketAir's mobility router, and ReefEdge's Mobile Domain techniques. These rely upon client-side software offered by WLAN card vendors or operating systems to address security on the WLAN at the link layer. In this regard, the authentication process is based on the new IEEE standard 802.1x and the encryption process is currently based on improved WEP (Wired Equivalency Privacy) with frequent key updates. The WEP approach to authentication, which relies on a commonly shared static key, is unacceptable for use in large-scale WLAN networks that need to support a great number of users. Furthermore, there are security flaws in the original WEP. The encryption algorithm will likely be changed to the Advanced Encryption Standard AES after the IEEE 802.11i standardization process is finished.
Unfortunately, user convenience with the above ZCMN techniques is limited by current 802.1x-based WLAN authentication protocols. For example, Lightweight Extensible Authentication Protocol (LEAP), a popular 802.1 x-based method, requires that every user have an associated account at a centralized authentication server, such as a Remote Authentication Dial In User Service (RADIUS) server. This makes it essentially impossible to have a completely zero-configuration solution because user-specific account information for each user must be pre-configured in the mobile host. In addition, because it is impossible for a user to open an account by connecting to the WLAN that only admits connections from users already having an account, the user must create an account using an out-of-band method, even though he or she is within the coverage of the WLAN.